{
  "$schema": "https://salus.cloud/mcp-tools.schema.json",
  "server": "cloud.salus/salus",
  "descriptor": "https://salus.cloud/mcp.json",
  "documentation": "https://salus.cloud/docs/cli/",
  "generated": "2026-08-24",
  "provenance": "Generated from the Salus CLI MCP tool registry (packages/core/src/mcp/registry.ts). The live server is authoritative: call MCP tools/list for full JSON Schemas.",
  "transport": "stdio",
  "authorization": {
    "type": "oauth2",
    "flow": "authorization_code_pkce",
    "issuer": "https://auth.salus.cloud/realms/salus",
    "discovery": "https://auth.salus.cloud/realms/salus/.well-known/openid-configuration",
    "notes": "The MCP server drives the browser sign-in itself (auth_login, then poll auth_status). The token is stored locally and shared with the salus CLI binary. Tools act as the signed-in user, with that user's access — the server holds no identity of its own."
  },
  "tiers": {
    "read": "View only, no side effects.",
    "write": "Create or modify resources; additive and reversible.",
    "operate": "Act on running workloads — deploy, roll back, take online or offline.",
    "destructive": "Delete resources; irreversible."
  },
  "presets": {
    "read_only": [
      "read"
    ],
    "standard": [
      "read",
      "write"
    ],
    "operator": [
      "read",
      "write",
      "operate"
    ],
    "full": [
      "read",
      "write",
      "operate",
      "destructive"
    ],
    "custom": "An explicit tool-name allowlist."
  },
  "defaultPreset": "operator",
  "presetNote": "The preset is chosen on the machine running the MCP server and decides which tools that server exposes. It is a client-side guardrail, not an organization-level policy — platform roles and permissions still apply to every call.",
  "toolCount": 52,
  "tools": [
    {
      "name": "auth_login",
      "title": "Sign in to Salus",
      "tier": "read",
      "description": "Begin the Salus OAuth (PKCE) login flow."
    },
    {
      "name": "auth_status",
      "title": "Check sign-in status",
      "tier": "read",
      "description": "Check whether Salus authentication has completed."
    },
    {
      "name": "auth_logout",
      "title": "Sign out of Salus",
      "tier": "write",
      "description": "Sign out of Salus."
    },
    {
      "name": "configure_tools",
      "title": "Configure tool permissions",
      "tier": "read",
      "description": "Open a browser page to choose which Salus tools the agent is allowed to use (Read-only, Standard, Operator, Full, or a custom selection)."
    },
    {
      "name": "list_organizations",
      "title": "List organizations",
      "tier": "read",
      "description": "List all Salus organizations the authenticated user has access to."
    },
    {
      "name": "list_spaces",
      "title": "List spaces",
      "tier": "read",
      "description": "List all spaces in a Salus organization."
    },
    {
      "name": "create_space",
      "title": "Create a space",
      "tier": "write",
      "description": "Create a new space (called \"workspace\" in the Salus UI) under an organization."
    },
    {
      "name": "delete_space",
      "title": "Delete a space",
      "tier": "destructive",
      "description": "Permanently delete a Salus space (workspace)."
    },
    {
      "name": "list_projects",
      "title": "List projects",
      "tier": "read",
      "description": "List all projects in a Salus space."
    },
    {
      "name": "delete_project",
      "title": "Delete a project",
      "tier": "destructive",
      "description": "Permanently delete a Salus project, including its deployments and configuration (the backend cascades)."
    },
    {
      "name": "list_environments",
      "title": "List environments",
      "tier": "read",
      "description": "List environments in a space, including each environment’s deployment target."
    },
    {
      "name": "list_applications",
      "title": "List VCS integrations",
      "tier": "read",
      "description": "List the organization's VCS integrations (source-control connections — GitHub, GitLab, Azure DevOps)."
    },
    {
      "name": "list_repositories",
      "title": "List repositories",
      "tier": "read",
      "description": "List Git repositories available to the organization via connected VCS applications."
    },
    {
      "name": "create_project",
      "title": "Create a project",
      "tier": "write",
      "description": "Create a new Salus project (a project shell) in a space, linked to a Git repository via a VCS application."
    },
    {
      "name": "update_project",
      "title": "Update a project",
      "tier": "write",
      "description": "Update an existing project's settings — name, description, default branch, build/install/test commands, source/publish paths, watch list, Docker options, node version, and the pipeline task-enforcement flags."
    },
    {
      "name": "deploy_repo",
      "title": "Deploy a repository",
      "tier": "operate",
      "description": "One-shot deploy FROM SCRATCH: creates a NEW Salus project for a git repo, attaches a release configuration, and triggers the first build pipeline — all in a single call."
    },
    {
      "name": "start_deployment",
      "title": "Start a deployment",
      "tier": "operate",
      "description": "Run a deployment for an EXISTING project by creating a new build pipeline — this does NOT create a new project or release configuration, it just runs a pipeline against what already exists."
    },
    {
      "name": "list_pipelines",
      "title": "List pipelines",
      "tier": "read",
      "description": "List build pipelines for a project, most recent first — to discover a pipelineId (for get_pipeline / get_build_logs) or review recent deploy history."
    },
    {
      "name": "get_pipeline",
      "title": "View pipeline status",
      "tier": "read",
      "description": "Fetch the current status of a build pipeline plus per-stage and per-task status — to poll an in-progress deploy or see why one did not cleanly succeed."
    },
    {
      "name": "get_build_logs",
      "title": "View build logs",
      "tier": "read",
      "description": "Fetch build logs for a specific stage/task of a pipeline."
    },
    {
      "name": "list_deployments",
      "title": "List deployments",
      "tier": "read",
      "description": "List deployments for a project."
    },
    {
      "name": "get_deployment_workload",
      "title": "View deployment workload",
      "tier": "read",
      "description": "Get the live workload (runtime) status of a project's deployment in an environment: overall health (Healthy/Degraded/Failed/Progressing), replica counts (desired/ready/available), autoscaling (min/max/current/desired), the list of running pods with their phase/state, and recent Kubernetes events."
    },
    {
      "name": "list_deployment_revisions",
      "title": "List deployment revisions",
      "tier": "read",
      "description": "List the deployment history for a project's environment — each past rollout as a revision, newest first."
    },
    {
      "name": "rollback_deployment",
      "title": "Roll back a deployment",
      "tier": "operate",
      "description": "Roll an environment back to a PRIOR deployment revision: redeploys the named revision so it becomes the live deployment again (recorded as a new 'rollBack' rollout)."
    },
    {
      "name": "list_release_configurations",
      "title": "List release configurations",
      "tier": "read",
      "description": "List a project's release configurations — one per environment."
    },
    {
      "name": "create_release_configuration",
      "title": "Create a release configuration",
      "tier": "write",
      "description": "Create a release configuration (the per-environment config that a deployment rolls out) for an EXISTING project."
    },
    {
      "name": "update_release_configuration",
      "title": "Update a release configuration",
      "tier": "operate",
      "description": "Update an existing release configuration (the per-environment config a deployment rolls out) for a project's environment — e.g."
    },
    {
      "name": "delete_deployment",
      "title": "Delete a deployment",
      "tier": "destructive",
      "description": "Permanently delete a release configuration — Salus's per-environment configuration, the same object list_release_configurations returns."
    },
    {
      "name": "set_deployment_offline",
      "title": "Take a deployment offline",
      "tier": "operate",
      "description": "Take an active deployment offline — stops serving traffic without deleting it."
    },
    {
      "name": "set_deployment_online",
      "title": "Bring a deployment online",
      "tier": "operate",
      "description": "Bring a deployment back online after it has been taken offline."
    },
    {
      "name": "get_deployment_metrics",
      "title": "View deployment metrics",
      "tier": "read",
      "description": "Fetch and aggregate runtime metrics for a deployment (request rate, latency percentiles, log severity counts) over a time window."
    },
    {
      "name": "get_deployment_overview",
      "title": "Deployment overview (how are we doing)",
      "tier": "read",
      "description": "The leadership \"how are we doing\" snapshot for deployments over a time window — aggregate, fleet-wide DORA-style health."
    },
    {
      "name": "list_deployment_leaderboard",
      "title": "Deployment leaderboard",
      "tier": "read",
      "description": "The ranked per-deployment scorecard behind get_deployment_overview — one row per project+environment over a time window, so you can see WHICH services are carrying (or dragging) the fleet."
    },
    {
      "name": "get_app_logs",
      "title": "View application logs",
      "tier": "read",
      "description": "Fetch runtime application logs for a deployed project over a time window."
    },
    {
      "name": "list_organization_events",
      "title": "List organization events",
      "tier": "read",
      "description": "Recent activity across the organization — the org-wide event feed, and a good first call when you land on an org and want \"what's changed lately / anything new or concerning?\"."
    },
    {
      "name": "get_environment_vulnerabilities",
      "title": "Get environment vulnerabilities",
      "tier": "read",
      "description": "The security posture of a project's deployment in one environment, plus how it got there."
    },
    {
      "name": "list_environment_variables",
      "title": "List environment variables",
      "tier": "read",
      "description": "List the effective environment variables at a level of the hierarchy (set entityType: organization, space, project, or releaseConfiguration)."
    },
    {
      "name": "get_environment_variable_hierarchy",
      "title": "View environment-variable hierarchy",
      "tier": "read",
      "description": "The complete environment-variable hierarchy for a release configuration's deployment: every variable from every level — organization, space, project, releaseConfiguration, and (when present) database — in one flat list, with override relationships made explicit."
    },
    {
      "name": "create_environment_variables",
      "title": "Create environment variables",
      "tier": "write",
      "description": "Create one or more environment variables at a level of the hierarchy (set entityType: organization, space, project, or releaseConfiguration, plus the ids that level needs)."
    },
    {
      "name": "update_environment_variable",
      "title": "Update an environment variable",
      "tier": "write",
      "description": "Update a single environment variable by id, at the level it lives at (set entityType + the ids that level needs)."
    },
    {
      "name": "delete_environment_variables",
      "title": "Delete environment variables",
      "tier": "destructive",
      "description": "Delete one or more environment variables by id at the level they live at (set entityType + the ids that level needs)."
    },
    {
      "name": "list_database_resources",
      "title": "List database tiers",
      "tier": "read",
      "description": "List available database resource tiers (SKUs) for the organization."
    },
    {
      "name": "list_databases",
      "title": "List databases",
      "tier": "read",
      "description": "List databases deployed in the organization."
    },
    {
      "name": "get_database",
      "title": "View database details",
      "tier": "read",
      "description": "Fetch full details for a Salus-deployed database — including connectionString and connectionEndpoints (hostname/port), users (usernames only), and database names."
    },
    {
      "name": "create_database",
      "title": "Create a database",
      "tier": "write",
      "description": "Create a new database instance on Salus."
    },
    {
      "name": "update_database",
      "title": "Update a database",
      "tier": "operate",
      "description": "Update a database's settings."
    },
    {
      "name": "rotate_database_password",
      "title": "Rotate database password",
      "tier": "operate",
      "description": "Rotate the owner (admin) password of a Salus database instance."
    },
    {
      "name": "delete_database",
      "title": "Delete a database",
      "tier": "destructive",
      "description": "Permanently delete a Salus database instance and all of its data."
    },
    {
      "name": "link_database_to_project",
      "title": "Link a database to a project",
      "tier": "write",
      "description": "Link a database instance to a project + environment."
    },
    {
      "name": "unlink_database_from_project",
      "title": "Unlink a database from a project",
      "tier": "operate",
      "description": "Remove the link between a database instance and a project + environment."
    },
    {
      "name": "list_projects_linked_to_database",
      "title": "List projects linked to a database",
      "tier": "read",
      "description": "List the projects (with space and environment) linked to a database instance, each with its link lifecycle status: 'Linking' (requested, access still being set up on the internal network), 'Linked' (in effect), or 'Unlinking' (access still being removed)."
    },
    {
      "name": "list_databases_linked_to_project",
      "title": "List databases linked to a project",
      "tier": "read",
      "description": "List the database instances linked to a project within an environment."
    }
  ],
  "enterpriseOnlyTools": [
    {
      "name": "list_allowed_custom_domains",
      "title": "List allowed custom domains",
      "tier": "read",
      "description": "List the base domains this Salus instance allows custom domains under."
    },
    {
      "name": "set_custom_domain",
      "title": "Set a custom domain",
      "tier": "operate",
      "description": "Set a custom domain on a project's deployment (release configuration) for an environment."
    },
    {
      "name": "remove_custom_domain",
      "title": "Remove a custom domain",
      "tier": "operate",
      "description": "Remove the custom domain from a project's deployment (release configuration) for an environment."
    }
  ]
}